Workday Admits Breach as Social Engineering Rears Ugly Head Yet Again
Data Breach Is Reportedly Due to an Employee Falling for Social Engineering Tactics
Social engineering. That’s how hackers breached Workday’s defences early this August, filfering away personal information from one of the company’s third-party customer relationship databases.
This much was admitted by Workday itself in a blog it published on Friday curiously titled “Protecting You From Social Engineering Campaigns: An Update From Workday.”
“At Workday, trust and transparency guide everything we do. We want to let you know about a recent social engineering campaign targeting many large organisations, including Workday,” the blog opened. “In this campaign, threat actors contact employees by text or phone pretending to be from human resources or IT. Their goal is to trick employees into giving up account access or their personal information.”
Workday Falls for Social Engineering
Bleeping Computer initially reported the breach. The site claims the data breach discovered as early as 6 August 2025. Google, meanwhile, said that the breach was committed by ShinyHunters, a group of hackers known for using voice phishing to steal corporate data by tricking company employees.
In the same blog, Workday also indicated there was “no indication of access to customer tenants or the data within them”—something corporate customers typically use to store the bulk of their human resources files and employees’ personal data. However, it should be noted that nowhere in the blog did the company rule out a breach of said tenants. This lack of such admission opens the possibility that this cyberattack could potentially be bigger than initially reported.
Moreover, Workday did not identify in said blog the breached third-party customer database platform and hasn’t done so as of press time. The data breach, though, comes from the heels of similar breaches targeting Salesforce-hosted databases used by large companies to store customer data. To date, Google, Cisco, airline giant Qantas, and retailer Pandora have all been breached, with voluminous amounts of data stolen from their Salesforce databases.
Workday, per the company’s website. has more than 11,000 corporate customers serving at least 70 million users worldwide.
